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Amendments _to the Claims : 

The listing of claims will replace all prior versions, and listings, of claims 
in the application: 

Listing of Claims: 



1. (Previously presented) A method for selectively shadowing only 
accesses to external storage media connected to a computer the method 
comprising: detecting a data access to an external storage medium; and writing a 
copy of the accessed data to a storage location other than the external storage 
medium; wherein the detecting step comprises intercepting an I/O request from 
the computer to an external storage media drive in which the external storage 
media is inserted. 



2, (Previously presented) 
write operation. 

3. (Previously presented) 
read operation. 



The method of claim 1 wherein the access is a 



The method of claim 1 wherein the access is a 
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4. (Canceled) 



5, (Currently amended) The method of claim 1 [[5]] wherein the I/O 
request is one of the group consisting of a file open or creation request, a write 
request, a file close request, a file system control request and a read request- 
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6. (Previously presented) The method of claim 5 further comprising: 
providing a proxy handler for the I/O request; and executing the proxy handler, 
in response to the detecting step. 



7. (Previously presented) The method of claim [4] 1 wherein the computer 
runs under an operating system and the I/O request is one of the group 
consisting of IRP_MJ_GREATE, IRPJMJL WRITE, IRP_MJ_CLOSE, 
IRP_MJ_FTLE_SYSTEM_CONTEOL and IRP_MJ JREAD packets. ' 

8. (Previously presented) The method of claim 7 further comprising: 
providing proxy handlers for the IRPJM J^CREATE , IRPJVIJ_WRITE, 
IRP_MJ_CLOSE and IRP_MJ_FILE_SYSTEM_CONT^ ROL packets; and 
executing one of the proxy handlers, in response to the detecting step when the 
I/O request is a respective packet selected from the group consisting of 
IRPJ\U_CREATE, IRP_MJ_WEITE, IRP_MJ_CLOSE and 
IRP_MJ_FILE_SYSTEM CONTROL packets. 

9. (Previously presented) The method of claim 8 further comprising: 
providing a proxy handlers for the IRP_MJ_READ packet; and executing the 
proxy handlers for the IRP_MJ_READ packet, in response to the detecting step 
when the I/O request is an IRP_MJREAD packet. 

10. (Previously presented) The method of claim 1 wherein the storage 
location other than the external storage media is a protected storage location. 

11- (Previously presented) The method of claim 1 further comprising: 
writing the data to the external storage medium after the step of writing a copy 
of the data to a storage location other than the external storage medium. 
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12. (Previously presented) The method of claim 1 further comprising: 
attaching to one or more file systems connected to an external storage media 
drive in which the external storage medium is inserted; and wherein the 
detecting step comprises intercepting I/O requests to the one or more file 
systems. 

13. (Previously presented) The method of claim 1 wherein the external 
storage medium is selected from the group consisting of a floppy disk; a CD, a 
removable hard disk drive, and a zip disk drive CD 

rn 

14. (Previously presented) The method of claim 1 further comprising: 

collecting the copy into a database where similar copies are collected; and ^ 
querying the database. ^ 

5 

15. (Currently amended) -Tho mcthodof claim 14 Amethod for selectively 
shadowing only accesses to externa l storage m flrfifl ^Ti-n ected to a computer, the 
method comprising: q 

detecting a data access to an external storage medium' ^ 
writing a copy of the accessed data to a storage location o tW thaw tlio 
external storage medium: 

collecting the copy into a databas e where similar copies are collected: and 
querying the database; 

wherein the_detectin g step comprises intercepting an I/O request from tfre 
computer to an external storage media drive in which the external storage media 
is inserted: 

wherein the database comprises records, each record comprising the 
copied data, a file name associated with the data, an identification of who 
initiated the data access, a station ID, and when the access was made. 
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16. (Previously presented) The method of claim 14 wherein the computer is 
connected to a computer network, and the detecting and copying steps are 
performed at the computer, and the collecting and querying steps are performed 
at another computer on the network. 

17. (Previously presented) The method of claim 14 wherein the collecting 
and querying steps are performed by a user with administrator privileges. 

18- (Previously presented) A computer readable medium on which is 

embedded computer software, the software performing a method, the method US 

rn 

comprising: detecting a data access to an external storage medium; and writing a (/) 

copy of the accessed data to a storage location other than the external storage 

medium; wherein the detecting step comprises intercepting an I/O request from 

the computer to an external storage media drive in which the external storage — 

media is inserted. $> 

03 
I— 

19. (Previously presented) The computer readable medium of claim 18 

wherein the access is a write operation. q 

20. (Canceled) 

21. (Previously presented) The computer readable medium of claim 18 
wherein the computer system runs under an operating system and the I/O 
request is one of the group consisting of ERP_MJ_CREATE, IRPJMJ_WRITE, 
IRP_MJ_CLOSE, IRP_MJ_FXLE_SYSTEM_CONTROL and DRP_MJ_READ 
packets. 

22. (Previously presented) An apparatus for selectively shadowing only 
accesses to external storage media connected to a computer, the apparatus 
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comprising; a detector that intercepts I/O requests from the computer to an 
external storage media drive in which the external storage media is inserted; 
and a storage, other than the external storage medium, connected to the 
detector, in which a copy of the accessed data is written. 

23. (Previously presented) The apparatus of claim 22 further comprising 
one or more proxy handlers connected to the detector, wherein the proxy 
handlers handle certain I/O requests. 

24. (Previously presented) The apparatus of claim 23 wherein the certain 
I/O requests comprise IRP_MJ_CREATE, IRP_MJ_WRITE, IRP JtfJ_CLOSE 
and IRPJV[J_FILE_SySTEM_CONTROL packet. 

25. (Previously presented) The apparatus of claim 24 wherein the certain 
I/O requests further comprise an IRP_MJ_READ packet. 

26. (Previously presented) The apparatus of claim 23 further comprising: a 
list, connected to at least some of the one or more proxy handlers, in which file 
identifiers are contained. 

27. (Previously presented) The apparatus of claim 26 wherein the file 
identifiers are IEP.FsContext values, 

28. (Previously presented) The apparatus of claim 23 further comprising: 
one or more counters, connected to at least some of the one or more proxy 
handlers, by which certain file operation? are counted. 
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29. (Previously presented) The apparatus of claim 23 wherein the computer 
runs under an operating system, and the one or more proxy handlers are 
connected to I/O request packet drivers supplied by the operating system. 

30. (Canceled) 

81. (Previously Presented) The method of claim 1 wherein the external 
storage medium is selected from the group consisting of a floppy disk; a writable 
CD, a removable hard disk drive, and a zip disk drive, 

32. (Previously presented) The computer readable medium of claim 18 
wherein the external storage medium is selected from the group consisting of a 
floppy disk; a writable CD, a removable hard disk drive, and a zip disk drive. 

33. (Previously presented) The apparatus of claim 22 wherein the external 
storage medium is selected from the group consisting of a floppy disk; a writable 
CD, a removable hard disk drive, and a zip disk drive. 
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